Web Recon
pale-knight/redteam-skillHTTP/HTTPS application-layer reconnaissance after a web service is identified: fingerprinting, content/API discovery, JS/source maps, proxy/cache topology, WAF, CMS, and known CVE/PoC candidates. Recon only — do not exploit, write files, or obtain a shell. Hand CVE candidates and attack surface to the operator, who may select /web-attack. Non-HTTP ports belong to /recon.
At a glance
This skill is for Research and helps you fingerprint web application technologies, discover hidden api endpoints, and identify web service vulnerabilities.
git clone --depth 1 https://github.com/pale-knight/redteam-skill
cp -r redteam-skill/skills/web-recon ~/.claude/skills/web-recon
Web SecurityReconnaissanceHttp Fingerprintingapi-discoveryCve Assessmentpenetration-testing
Also in pale-knight/redteam-skill
View the repoActive Directory exploitation after domain credentials exist: Kerberos (AS-REP/Kerberoast including cracking the ticket then using the accou...
Active Directory reconnaissance with or without credentials: user/group/computer enumeration, ACL/delegation, ADCS, modern Windows LAPS, Blo...
CI/CD pipeline and software-supply-chain exploitation: Jenkins, GitHub Actions, GitLab CI/CD, Azure DevOps, Gitea/Forgejo, self-hosted runne...
Cloud control-plane exploitation for AWS, Azure/Entra, GCP, and Alibaba Cloud: IAM/RAM privilege escalation, impersonation, cross-account tr...
Cloud control-plane reconnaissance for AWS, Azure/Entra, GCP, and Alibaba Cloud: identity, IAM/RAM, trust, resources, metadata, and managed-...
Credential operations: secret discovery, classification, extraction, conversion, offline cracking of hashes the operator already has as a cr...
Endpoint defense evasion after an operator-selected chain already has a valid execution path but AV/EDR/AMSI/WDAC/PPL/memory/kernel telemetr...
Kubernetes and container exploitation: identity/RBAC, secrets, kubelet/etcd, managed-cloud workload identities, container-to-node escape inc...
Client-side initial access and social-engineering attack module. Use when the operator selects a human/client/browser/identity-delivery atta...
OS post-exploitation after a stable host foothold: quiet host recon, host-native persistence (Windows Run/tasks/services/COM/WMI and Linux S...
Linux local privilege escalation from a low-privilege shell to root. Covers quiet vs loud enumeration, sudo/GTFOBins, CVE-2025-32463 chwoot...
Windows local privilege escalation from a low-privilege shell to Administrator or SYSTEM. Covers quiet vs loud enumeration, SeImpersonate/Po...
Other Research skills
Investigate a question against high-trust primary sources and capture the findings as a Markdown file in the repo. Use when the user wants a...
Recent community and social trend research over the last 30 days. Use when the brief asks what people are saying now, recent sentiment, comm...
X/Twitter public sentiment research for recent market, company, product, or community discourse. Use when the brief asks what people are say...
Organize research — manage references, notes, and collaboration.
查询 AI HOT 的中文 AI 资讯、精选、当前热点和日报。用户询问今天或最近的 AI 新闻、AI 圈动态、大模型或产品发布、OpenAI／Anthropic／Google 最新...
Convene the Council of High Intelligence — multi-persona deliberation with historical thinkers for deeper analysis of complex problems.